Skip to content
OpenAdvisories
Medium USN-6098-1 8 CVEs

Jhead vulnerabilities

Published May 23, 2023 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Jhead did not properly handle certain crafted images
while processing the JFIF markers. An attacker could cause Jhead to crash. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
(CVE-2019-19035)

It was discovered that Jhead did not properly handle certain crafted images
while processing longitude tags. An attacker could cause Jhead to crash. This
issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-1010301)

It was discovered that Jhead did not properly handle certain crafted images
while processing IPTC data. An attacker could cause Jhead to crash. This
issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-1010302)

Binbin Li discovered that Jhead did not properly handle certain crafted images
while processing the DQT data. An attacker could cause Jhead to crash.
(CVE-2020-6624)

Binbin Li discovered that Jhead did not properly handle certain crafted images
while processing longitude data. An attacker could cause Jhead to crash.
(CVE-2020-6625)

Feng Zhao Yang discovered that Jhead did not properly handle certain crafted
images while reading JPEG sections. An attacker could cause Jhead to crash.
(CVE-2020-26208)

It was discovered that Jhead did not properly handle certain crafted images
while processing Canon images. An attacker could cause Jhead to crash.
(CVE-2021-28276)

It was discovered that Jhead did not properly handle certain crafted images
when removing a certain type of sections. An attacker could cause Jhead to
crash. (CVE-2021-28278)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS jhead 1:3.00-8~ubuntu0.1
Ubuntu · 20.04 LTS 20.04:LTS jhead 1:3.04-1ubuntu0.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS jhead 1:2.97-1+deb8u2ubuntu0.1~esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS jhead 1:3.00-4+deb9u1ubuntu0.1~esm1

Vulnerabilities 8

  • Medium 5.3
    CVE-2020-26208

    Heap-buffer-overflow in jhead

    JHEAD is a simple command line tool for displaying and some manipulation of EXIF header data embedded in Jpeg images from digital cameras. In affected versions there is a heap-buffer-overflow on jhead-3.04/jpgfile.c:285 ReadJpegSections. Crafted jpeg images c…

    jhead jhead Debian Ubuntu
  • Unscored —
    CVE-2019-1010301

    jhead 3.03 is affected by: Buffer Overflow. The impact is: Denial of service. The component is: gpsinfo.c Line 151 Proc…

    jhead jhead jhead jhead Debian Ubuntu
  • Unscored —
    CVE-2019-1010302

    jhead 3.03 is affected by: Incorrect Access Control. The impact is: Denial of service. The component is: iptc.c Line 12…

    jhead jhead jhead jhead Debian Ubuntu
  • Unscored —
    CVE-2019-19035

    jhead 3.03 is affected by: heap-based buffer over-read. The impact is: Denial of service. The component is: ReadJpegSec…

    jhead jhead Debian Ubuntu
  • Unscored —
    CVE-2020-6624

    jhead through 3.04 has a heap-based buffer over-read in process_DQT in jpgqguess.c.

    jhead jhead Debian Ubuntu
  • Unscored —
    CVE-2020-6625

    jhead through 3.04 has a heap-based buffer over-read in Get32s when called from ProcessGpsInfo in gpsinfo.c.

    jhead jhead Debian Ubuntu
  • Unscored —
    CVE-2021-28276

    A Denial of Service vulnerability exists in jhead 3.04 and 3.05 via a wild address read in the ProcessCanonMakerNoteDir…

    jhead jhead Debian Ubuntu
  • Unscored —
    CVE-2021-28278

    A Heap-based Buffer Overflow vulnerability exists in jhead 3.04 and 3.05 via the RemoveSectionType function in jpgfile.…

    jhead jhead Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2019-19035
  • report
    https://ubuntu.com/security/CVE-2019-1010301
  • report
    https://ubuntu.com/security/CVE-2019-1010302
  • report
    https://ubuntu.com/security/CVE-2020-6624
  • report
    https://ubuntu.com/security/CVE-2020-6625
  • report
    https://ubuntu.com/security/CVE-2020-26208
  • report
    https://ubuntu.com/security/CVE-2021-28276
  • report
    https://ubuntu.com/security/CVE-2021-28278